Layering and Spoofing Detection Test

Description

This test identifies manipulative trading behaviors where a trader uses non-bona fide orders to create a false perception of market supply or demand.

Spoofing: Placing visible orders at the top of the order book to influence the market, executing trades on the opposite side at a favorable price, followed by rapid order cancellation.
Layering: Extending spoofing by placing multiple non-bona fide orders across price tiers to manipulate the market midpoint.

This test analyzes order placement, cancellation patterns, and subsequent executions to flag significant deviations from normal trading behavior.

Market Manipulation Detection: Identifies traders employing layering or spoofing tactics to distort market supply or demand, influencing prices unfairly and misleading other participants.
Regulatory Oversight: Monitors behaviors that breach market manipulation regulations, enabling compliance teams to detect, investigate, and report non-compliant trading activity.

Variable	Description
`timestamp`	Timestamp of the trade (YYYY-MM-DD hh:mm:ss).
`user_id`	User ID to identify the individual user.
`currency_type`	The currency type of trade; fiat or crypto.
`symbol_pair`	Asset symbol; e.g., BTCUSDT, SHIBETH.
`side`	Whether the trade is a BUY or SELL.
`price_usd`	Price of the symbol in USD.
`price`	Execution price of the symbol pair.
`amount`	Amount of the symbol being traded.

Variable	Description
`user_id`	User ID to identify the individual user.
`order_id`	Unique identifier for the order.
`order_start_timestamp`	Order creation timestamp.
`order_end_timestamp`	Last update timestamp.
`symbol_pair`	Asset symbol; e.g., BTCUSDT, SHIBETH.
`status`	CANCELLED, FILLED, or PARTIALLY FILLED.
`price_usd`	Price of the symbol in USD.
`amount`	Amount of the symbol being traded.
`side`	Whether the trade is a BUY or SELL.
`price`	Quote currency value; e.g., ETH/BTC = 0.03781.

Parameter	Description	Type	Default Value	Configurable
`historical_cancellation_period_window`	Days to get orders for calculating avg cancellation period.	Integer	3	Yes
`analysis_rolling_window_seconds`	Time before a trade to analyze orders & cancellations.	Integer	60	Yes
`spoofing_execution_window`	Time after rolling window to analyze executed trades.	Integer	300	Yes
`spoofing_cancellation_volume_multiplier`	Multiplier for avg historical cancellation volume.	Float	1	Yes
`spoofing_orders_to_trades_volume_ratio`	Min ratio of spoofing order volume to trade volume.	Float	1	Yes
`minimum_executed_dollar_threshold`	Min executed trade volume to analyze activity.	Float	500	Yes
`mm_buy_sell_dollar_volume_threshold`	Threshold for buy/sell balance to exclude market makers.	Float	0.2	Yes

Aggregate User Activity Analyze transaction and order data by aggregating total dollar volumes and trade counts for each user over a defined time period. This helps identify patterns of fund movement or concentrated activity.
Set Thresholds for Anomaly Detection Establish thresholds for normal activity based on historical averages and deviations. Transactions and cancellations that exceed these thresholds are flagged for further scrutiny.
Analyze Cancellation-to-Trade Ratios Compare the volume of canceled orders to executed trades for each user. Flag users with disproportionate ratios or excessively high cancellation volumes, especially when these ratios exceed pre-defined limits.
Segment and Detect Temporal Patterns Break down data into rolling time windows to examine short-term activity. Identify users engaging in rapid cancellations or trades indicative of manipulative behavior.
Generate Reports for Flagged Users Summarize flagged users’ activity, including key metrics like cancellation volumes, trade counts, and abnormal patterns. Store these results in detailed reports for compliance investigations.